AM2631: Protecting image on external flash

Hang Yang

Part Number: AM2631

Tool/software:

Hi Experts,

From the document Security in External Flash devices — AM26x Academ we know the OTFA/OTFE Protection feature can protect the image on external flash without impact on performance, but it's not available on AM263x devices.

In this case, how can we achieve protection of external flash when using AM2631?

Regards,

Hang.

7 months ago

0 Nilabh Anand 7 months ago

TI__Mastermind 48800 points

Hi Hang,

Since AM2631 does not support eXecute In Place(XIP), it des not require OTFA feature. We do not have this feature on Am263x device.

0 Nilabh Anand 7 months ago

TI__Mastermind 48800 points

Hang Yang said:
In this case, how can we achieve protection of external flash when using AM2631?

Now coming to this question, The security of the SBL and application image is ensured by the authentication sequence performed by HSM-ROM and HSMRT.

When ROM fetches the SBL image from external flash, it is authenticated by the HSM ROM before booting, if authentication passes then only SBL boots, thus ensuring the system security.

Same is done for application, the application is authenticated by HSM-RT on HSSE devices.

0 Hang Yang 7 months ago in reply to Nilabh Anand

TI__Expert 3031 points

Hi Nilabh,

The authentication sequence can protect the image from being tempered, but it can't protect the image from being read, right?

Attacker can still move the flash to another board and read out the image. Is there any way to protect the image from this?

Regards,

Hang.

0 Nilabh Anand 7 months ago in reply to Hang Yang

TI__Mastermind 48800 points

Hi Hang,

We have provision to encrypt the image during build time, which will not allow the image to be read even if the flash chip is moved.

ROm supports authentication an decryption of the encrypted SBL and application image.

0 Hang Yang 7 months ago in reply to Nilabh Anand

TI__Expert 3031 points

Hi Nilabh,

I see it now.

Does ROM decrypt the app image in run time? If yes this should impact code performance, right? Is there any benchmark showing the cost in performance?

Regards,

Hang

0 Nilabh Anand 7 months ago in reply to Hang Yang

TI__Mastermind 48800 points

Hang Yang said:
If yes this should impact code performance, right? Is there any benchmark showing the cost in performance?

Regards,

Since the decyption is done by offloading it to crypto accelerators, no direct impact on code execution.

Check the performance here: AM263x MCU+ SDK: Datasheet

Arm-based microcontrollers

Arm-based microcontrollers forum

AM2631: Protecting image on external flash